Malware Analysis Report

2024-12-07 22:27

Sample ID 240408-kz93bagg9s
Target Quotation.xls
SHA256 aa82e4e3c64666daaf9da5f189250e969a04e9d7123e068af593b954139526b5
Tags
remcos remotehost rat
score
10/10

Table of Contents

Analysis Overview

MITRE ATT&CK

Enterprise Matrix V15

Analysis: static1

Detonation Overview

Signatures

Analysis: behavioral1

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis: behavioral2

Detonation Overview

Command Line

Signatures

Processes

Network

Files

Analysis Overview

score
10/10

SHA256

aa82e4e3c64666daaf9da5f189250e969a04e9d7123e068af593b954139526b5

Threat Level: Known bad

The file Quotation.xls was found to be: Known bad.

Malicious Activity Summary

remcos remotehost rat

Remcos

Blocklisted process makes network request

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Loads dropped DLL

Drops startup file

Executes dropped EXE

Suspicious use of SetThreadContext

AutoIT Executable

Office loads VBA resources, possible macro or embedded object present

Suspicious use of AdjustPrivilegeToken

Suspicious use of WriteProcessMemory

Launches Equation Editor

Uses Volume Shadow Copy service COM API

Uses Task Scheduler COM API

Suspicious use of SendNotifyMessage

Suspicious use of SetWindowsHookEx

Modifies registry class

Uses Volume Shadow Copy WMI provider

Suspicious behavior: MapViewOfSection

Suspicious behavior: AddClipboardFormatListener

Enumerates system info in registry

Suspicious use of FindShellTrayWindow

Checks processor information in registry

Modifies Internet Explorer settings

MITRE ATT&CK

Analysis: static1

Detonation Overview

Reported

2024-04-08 09:03

Signatures

N/A

Analysis: behavioral1

Detonation Overview

Submitted

2024-04-08 09:03

Reported

2024-04-08 09:06

Platform

win7-20240221-en

Max time kernel

149s

Max time network

153s

Command Line

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Quotation.xls

Signatures

Remcos

rat remcos

Blocklisted process makes network request

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Downloads MZ/PE file

Abuses OpenXML format to download file from external location

Drops startup file

Description Indicator Process Target
File created C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Start Menu\Programs\Startup\excel.vbs C:\Users\Admin\AppData\Local\directory\excel.exe N/A

Executes dropped EXE

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Roaming\winnit.exe N/A
N/A N/A C:\Users\Admin\AppData\Local\directory\excel.exe N/A

AutoIT Executable

Description Indicator Process Target
N/A N/A N/A N/A
N/A N/A N/A N/A

Suspicious use of SetThreadContext

Description Indicator Process Target
PID 1056 set thread context of 2336 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe

Office loads VBA resources, possible macro or embedded object present

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\FloatingPointProcessor C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Launches Equation Editor

exploit
Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE N/A

Modifies Internet Explorer settings

adware spyware
Description Indicator Process Target
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\EXCEL.EXE/3000" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\ = "res://C:\\PROGRA~2\\MICROS~1\\Office14\\ONBttnIE.dll/105" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar\ShowDiscussionButton = "Yes" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt\E&xport to Microsoft Excel\Contexts = "1" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\ = "&Edit" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\Toolbar C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\COMMAND C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default HTML Editor\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Set value (int) \REGISTRY\USER\S-1-5-21-1658372521-4246568289-2509113762-1000\Software\Microsoft\Internet Explorer\MenuExt\Se&nd to OneNote\Contexts = "55" C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Wow6432Node\Microsoft\Internet Explorer\Default MHTML Editor\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Modifies registry class

Description Indicator Process Target
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\WINWORD.EXE\" /n \"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\msohtmed.exe\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\ShellEx C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\WinWord.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\MSPub.exe\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key deleted \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\EXCEL.EXE\" /dde" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shell\Edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\topic C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version\14 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\shellex\IconHandler C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Word\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0057004f0052004400460069006c00650073003e00620069002400540021005600210030005a003d007b0050006b00300076006d007e0041005a00750020002f006e002000220025003100220000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shell\Print\ = "&Print" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Word C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\htmlfile\DefaultIcon\ = "\"%1\"" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec\application\ = "Excel" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\mhtmlfile\shellex\IconHandler\ = "{42042206-2D85-11D3-8CFF-005004838597}" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\ = "&Open" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Publisher\shell\edit\command\ = "\"C:\\Program Files (x86)\\Microsoft Office\\Office14\\MSPUB.EXE\" %1" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe\shell\edit\command C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Excel.exe\shell\edit\ddeexec C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\ = "[open(\"%1\")]" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Publisher\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b005000750062005000720069006d006100720079003e00520024006e0075006a0053005700460065003f007d0061004c00720052007000390078004000570020002500310000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (str) \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Excel.exe\shell\edit\ddeexec\topic\ = "system" C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\MSPub.exe\shell\edit C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\Version C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597}\InprocServer32 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\WinWord.exe C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Set value (data) \REGISTRY\MACHINE\SOFTWARE\Classes\.htm\OpenWithList\Microsoft Excel\shell\edit\command\command = 7800620027004200560035002100210021002100210021002100210021004d004b004b0053006b0045005800430045004c00460069006c00650073003e00560069006a00710042006f006600280059003800270077002100460049006400310067004c00510020002f0064006400650000000000 C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\.mht\OpenWithList\Microsoft Excel C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A
Key created \REGISTRY\MACHINE\SOFTWARE\Classes\Wow6432Node\CLSID\{42042206-2D85-11D3-8CFF-005004838597} C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE N/A

Suspicious behavior: MapViewOfSection

Description Indicator Process Target
N/A N/A C:\Users\Admin\AppData\Local\directory\excel.exe N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2416 wrote to memory of 1776 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2416 wrote to memory of 1776 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2416 wrote to memory of 1776 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 2416 wrote to memory of 1776 N/A C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE C:\Windows\splwow64.exe
PID 1848 wrote to memory of 920 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\winnit.exe
PID 1848 wrote to memory of 920 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\winnit.exe
PID 1848 wrote to memory of 920 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\winnit.exe
PID 1848 wrote to memory of 920 N/A C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE C:\Users\Admin\AppData\Roaming\winnit.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 920 wrote to memory of 1056 N/A C:\Users\Admin\AppData\Roaming\winnit.exe C:\Users\Admin\AppData\Local\directory\excel.exe
PID 1056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 1056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 1056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 1056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe
PID 1056 wrote to memory of 2336 N/A C:\Users\Admin\AppData\Local\directory\excel.exe C:\Windows\SysWOW64\svchost.exe

Processes

C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\EXCEL.EXE" /dde C:\Users\Admin\AppData\Local\Temp\Quotation.xls

C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE

"C:\Program Files (x86)\Microsoft Office\Office14\WINWORD.EXE" -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE

"C:\Program Files (x86)\Common Files\Microsoft Shared\EQUATION\EQNEDT32.EXE" -Embedding

C:\Users\Admin\AppData\Roaming\winnit.exe

"C:\Users\Admin\AppData\Roaming\winnit.exe"

C:\Users\Admin\AppData\Local\directory\excel.exe

"C:\Users\Admin\AppData\Roaming\winnit.exe"

C:\Windows\SysWOW64\svchost.exe

"C:\Users\Admin\AppData\Roaming\winnit.exe"

Network

Country Destination Domain Proto
US 8.8.8.8:53 qr-in.com udp
US 3.140.76.209:80 qr-in.com tcp
US 3.140.76.209:443 qr-in.com tcp
US 192.3.95.135:80 192.3.95.135 tcp
US 3.140.76.209:80 qr-in.com tcp
US 3.140.76.209:80 qr-in.com tcp
US 3.140.76.209:443 qr-in.com tcp
US 3.140.76.209:443 qr-in.com tcp
US 3.140.76.209:443 qr-in.com tcp
US 3.140.76.209:443 qr-in.com tcp
US 192.3.95.135:80 192.3.95.135 tcp
US 8.8.8.8:53 shgoini.com udp
US 107.175.229.143:30902 shgoini.com tcp
US 8.8.8.8:53 geoplugin.net udp
NL 178.237.33.50:80 geoplugin.net tcp
US 107.175.229.143:30902 shgoini.com tcp
US 107.175.229.143:30902 shgoini.com tcp

Files

memory/2168-0-0x000000005FFF0000-0x0000000060000000-memory.dmp

memory/2168-1-0x000000007273D000-0x0000000072748000-memory.dmp

memory/2416-22-0x000000002F131000-0x000000002F132000-memory.dmp

memory/2416-24-0x000000007273D000-0x0000000072748000-memory.dmp

memory/2416-26-0x0000000003610000-0x0000000003612000-memory.dmp

memory/2168-27-0x0000000003040000-0x0000000003042000-memory.dmp

C:\Users\Admin\AppData\Roaming\Microsoft\Windows\Cookies\B6U4592A.txt

MD5 4818157d8d862c838757844f54049009
SHA1 339ef47260b3b1b0647aa7ca15d8ad77e9721dea
SHA256 6272964fddd526b4ed62cd379a811082bff7abef917a1699ce511405ca23b9e5
SHA512 2d4bc1a60b473699b5833589b88001c7d384d41014d90e939bbd3ef6a6a65ffed831d80726136e1d00f0ad760c2e7ae363b765a05eb193fd6bd944cf8180c802

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-CNRY.FSD

MD5 eb11aa9d12df66ab6fee0689fb297623
SHA1 37a42652f32256bc70e5f11d5e7ea536186eab3a
SHA256 1b4a4f38d0ebd935715d702d2bdb9689917a1d01e8fcfc23ad5ceb21163c1f43
SHA512 2ebd3d737d79041628538bf64bf7750edf1f47b8fc0ad22ade7f0f4a34be05b5ee1701ffc24c1e6830dff99ff1ac53de2aad15abaf3941385d2e131537206237

C:\Users\Admin\AppData\Local\Temp\{65B8333E-F864-4838-8209-861C65008FC6}

MD5 d005dc8e99f64201026d4243ed7a494b
SHA1 2cf49c606a6d43a1784382ebf5651edf44c0ce4f
SHA256 30fce3cbd43eb21a4443ba37ce3df431c590a2da6bac801dc53d320913fd6292
SHA512 d527c21bf57cd6cde09436b7c20ceb8796bbd4ffef1f4676c664b2175b195129cda7f73a04f85c43ee516f096e8ab7362029d03b4d1ef59584b9ac38aa2382eb

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\FSD-{F2CAC9A3-282B-40A1-A83C-3E72E2EDDE85}.FSD

MD5 b40e98715a7187a001c32fcdaaa0a405
SHA1 71ae5394ea200f62f90981d4ccdd11cd4c5dd329
SHA256 617de0fbb7a3ee3189f6f3a3433efd54fde25fa182db734c5938f88641dfbb4c
SHA512 5d3958186e7768179badb9289529783799e74a14be7cb23e517b40d833b9ef9732853d85983c235f9d5084326c969f279c4d4039ca072f7796ba31f280c02c31

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-CNRY.FSD

MD5 28de441f55d137a856e3df037543c2e9
SHA1 c9372e0a827ab2559848502bef23e1e610e69fcb
SHA256 25bacff74bbd282cbaff32452006a7dd7684a861272407d18efe5654dd88b315
SHA512 30b29dc975bd68772f40fe4c90f6a63d43d04083e63badce45115a241d979a85e2f0b65c04dbfd252646dbe1b5b29c53684ddace30758520dc30d705483edc0a

C:\Users\Admin\AppData\Local\Microsoft\Office\14.0\OfficeFileCache\LocalCacheFileEditManager\FSD-{004A2899-223D-4DFA-9115-876FCA5E4A84}.FSD

MD5 b5f137d9d964983eeb197a9a770e9876
SHA1 da39af50becd1e6e83bb9cd764fca527d06a972b
SHA256 a0ba33bd11b9dc1685a7e4562544a81fce729b3a2678064ba482b2eb0d90de32
SHA512 5c73777d446fc08514bdd2becec475e0f220ffa45c03f70b5d6d3ac1b2481a9e6f07649fadc9cc01df5a4804b6023ebb3c7846351c3a7edfc63ca5fa354f6c39

memory/2168-91-0x000000007273D000-0x0000000072748000-memory.dmp

memory/2416-92-0x000000007273D000-0x0000000072748000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Windows\Temporary Internet Files\Content.IE5\K224YIDM\wecontactedloverstounderstandhowhotgirlchickessheisbutshesaidiamveryhotgirltokiss____whatabeautifulgirlsheistokissandenjoytheday[1].doc

MD5 3d9950539df8ffe5a6ad65a287dd1abe
SHA1 8b9b0a3ab75e0d7747c6237df529f856452bf35a
SHA256 ade7914eb1ec3171d987bff5bf1bb486112a3ca0c2984599f68089e154692a7d
SHA512 2c51ec7576a80107c42367506375a643a01f5b14c9afb3455c02762d45624a8a17d44fb20c487cfffa2f51175ba4fc9102f290d41ee52d465dc86641cbd4e507

C:\Users\Admin\AppData\Roaming\winnit.exe

MD5 ae56732543285a58949d9075e09f6d27
SHA1 0ae46a2ff42a54a554da0572ccc46951b8dcf447
SHA256 b590ff3add4c1ebcacd534ee89ec429df2fc3c417b68e0440312fab4e8432ab2
SHA512 9ab19109c7d461e47539501b96eb1aa755b00a969e76b5e1c4afdaa1685b0f5788023a47b7dd70fe34949309a3a84dc3dc39658a72428c04270b801b00b4152c

memory/920-116-0x0000000000130000-0x0000000000134000-memory.dmp

\Users\Admin\AppData\Local\directory\excel.exe

MD5 032f906fc2f3dd6f5deb8f2cf7c3e58b
SHA1 7067cd0b95276caa42407e4f9098b8882047dbd5
SHA256 afc352e156ad5edb0f642f1369fa052688edd2fd0375477f66f5b94873a30850
SHA512 16e2fa43d7a0e9fa38a7a65935144a5f4dba4a1dc5c105cebc9e034c26fc05c0f25e7438eace0dc817b82316cd4473fe593a43589b66e76c12db6b8916165382

C:\Users\Admin\AppData\Local\Temp\Vevine

MD5 d41d8cd98f00b204e9800998ecf8427e
SHA1 da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256 e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512 cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e

C:\Users\Admin\AppData\Local\Temp\acrorrheuma

MD5 479b8ebaed46c941e61868e8d2f665fe
SHA1 212b11543ef433b12a4c96eb48ee2348a5514639
SHA256 39269e1cfe05077ba3839634b50a95698173cf9e0e93fadf96d6a8710544d239
SHA512 29ef60024cbe7fcb3185c4ce3a2589bac41168a2b69caed22bd7d6d5ce8d3d52dc9aa991e7645e856be51cfe10f13907aa9e9798e82dbd38a767e4a0d50cd440

memory/2336-136-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-138-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-139-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-140-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-141-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-142-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-143-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-144-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-146-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-147-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-148-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-149-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-150-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-151-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-152-0x0000000000400000-0x0000000000482000-memory.dmp

memory/2336-153-0x0000000000400000-0x0000000000482000-memory.dmp

Analysis: behavioral2

Detonation Overview

Submitted

2024-04-08 09:03

Reported

2024-04-08 09:06

Platform

win10v2004-20240226-en

Max time kernel

148s

Max time network

157s

Command Line

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Quotation.xls"

Signatures

Checks processor information in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\CentralProcessor\0 C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\~MHz C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\CentralProcessor\0\ProcessorNameString C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Enumerates system info in registry

Description Indicator Process Target
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
Key opened \REGISTRY\MACHINE\Hardware\Description\System\BIOS C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemFamily C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A
Key value queried \REGISTRY\MACHINE\HARDWARE\DESCRIPTION\System\BIOS\SystemSKU C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious behavior: AddClipboardFormatListener

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of AdjustPrivilegeToken

Description Indicator Process Target
Token: SeAuditPrivilege N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE N/A

Suspicious use of FindShellTrayWindow

Description Indicator Process Target
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A
N/A N/A C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE N/A

Suspicious use of WriteProcessMemory

Description Indicator Process Target
PID 2272 wrote to memory of 2008 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe
PID 2272 wrote to memory of 2008 N/A C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE C:\Windows\splwow64.exe

Uses Task Scheduler COM API

persistence

Uses Volume Shadow Copy WMI provider

ransomware

Uses Volume Shadow Copy service COM API

ransomware

Processes

C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE

"C:\Program Files\Microsoft Office\Root\Office16\EXCEL.EXE" "C:\Users\Admin\AppData\Local\Temp\Quotation.xls"

C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE

"C:\Program Files\Microsoft Office\Root\Office16\WINWORD.EXE" -Embedding

C:\Windows\splwow64.exe

C:\Windows\splwow64.exe 12288

C:\Windows\system32\svchost.exe

C:\Windows\system32\svchost.exe -k PrintWorkflow -s PrintWorkflowUserSvc

Network

Country Destination Domain Proto
US 8.8.8.8:53 28.118.140.52.in-addr.arpa udp
US 8.8.8.8:53 91.90.14.23.in-addr.arpa udp
US 8.8.8.8:53 46.28.109.52.in-addr.arpa udp
US 8.8.8.8:53 qr-in.com udp
US 3.140.76.209:80 qr-in.com tcp
US 3.140.76.209:443 qr-in.com tcp
US 8.8.8.8:53 209.76.140.3.in-addr.arpa udp
US 8.8.8.8:53 68.159.190.20.in-addr.arpa udp
US 8.8.8.8:53 11.97.55.23.in-addr.arpa udp
US 8.8.8.8:53 170.101.63.23.in-addr.arpa udp
US 192.3.95.135:80 192.3.95.135 tcp
US 8.8.8.8:53 135.95.3.192.in-addr.arpa udp
US 8.8.8.8:53 27.173.189.20.in-addr.arpa udp
US 8.8.8.8:53 239.249.30.184.in-addr.arpa udp
US 8.8.8.8:53 58.55.71.13.in-addr.arpa udp
US 8.8.8.8:53 157.123.68.40.in-addr.arpa udp
US 8.8.8.8:53 18.31.95.13.in-addr.arpa udp
US 8.8.8.8:53 81.139.73.23.in-addr.arpa udp
US 8.8.8.8:53 14.227.111.52.in-addr.arpa udp
US 8.8.8.8:53 11.173.189.20.in-addr.arpa udp

Files

memory/2244-0-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

memory/2244-1-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

memory/2244-2-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

memory/2244-3-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-4-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

memory/2244-5-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-6-0x00007FFBB78D0000-0x00007FFBB78E0000-memory.dmp

memory/2244-7-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-8-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-10-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-9-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-12-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-13-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-11-0x00007FFBB5280000-0x00007FFBB5290000-memory.dmp

memory/2244-14-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-16-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-17-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-18-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-15-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-20-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-21-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2244-19-0x00007FFBB5280000-0x00007FFBB5290000-memory.dmp

memory/2272-41-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-42-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-44-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-46-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-47-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-48-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-49-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-50-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-52-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-53-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-54-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

C:\Users\Admin\AppData\Local\Microsoft\Office\16.0\WebServiceCache\AllUsers\officeclient.microsoft.com\57EFED74-D0AE-4F2F-8C05-C7DA3040F4F9

MD5 f8c4946d5711364c094f5961a938422d
SHA1 c0ad96907298023c79bb1fc9d45c70112ff5a1e1
SHA256 f5bf210d54f2021f044280c7850de54d74add8cac72adfea2fa6c53b68e682b4
SHA512 52fd433e78f2a8afcde58e6aa2f68684de6544bf172e5ffad57830cc53723f9ad1b4dc5b09a5350d830bd648f503147d0d22569245fc5485542cbd9ae99737fe

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\49dbe2955480c7f6ef8cec9c4320c9868d9293fd.tbres

MD5 3daa528f49576b937cf6e138ee75edab
SHA1 7601d268d2a9b3c82c27ea15535d18c6cbb9df95
SHA256 318b82a2c89acd12dd7221f0c0539b63418e84e172fad38a8a97be25423e367b
SHA512 4c8c3b406b28db75219ba0462b281464d2a5ee2f103ef6920d7eb8ff9d79826f3b0572f96b944e79309a706a2073b0e8865f5aa9969961f408b76f660781505d

C:\Users\Admin\AppData\Local\Microsoft\TokenBroker\Cache\089d66ba04a8cec4bdc5267f42f39cf84278bb67.tbres

MD5 e498ce8e6dfe1bc53868288b6fef223a
SHA1 462dafdb9776e2cb92a2763063691769a323669a
SHA256 b89d040d61f491af10e668f3cf60e3020024b16d404ba7c3339ca5b2510a44ed
SHA512 7103241bdeea8fda924912e7c27123ef45bc576fbaad3e12d32aa591f5afacf84a742b12a9e5e821645b01026ebea9847f7f42c4af11507628070c94e522c085

C:\Users\Admin\AppData\Local\Microsoft\Windows\INetCache\IE\7U91ICFQ\wecontactedloverstounderstandhowhotgirlchickessheisbutshesaidiamveryhotgirltokiss____whatabeautifulgirlsheistokissandenjoytheday[1].doc

MD5 3d9950539df8ffe5a6ad65a287dd1abe
SHA1 8b9b0a3ab75e0d7747c6237df529f856452bf35a
SHA256 ade7914eb1ec3171d987bff5bf1bb486112a3ca0c2984599f68089e154692a7d
SHA512 2c51ec7576a80107c42367506375a643a01f5b14c9afb3455c02762d45624a8a17d44fb20c487cfffa2f51175ba4fc9102f290d41ee52d465dc86641cbd4e507

memory/2244-73-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp

memory/2272-76-0x00007FFBF7850000-0x00007FFBF7A45000-memory.dmp